set hostid 0x6d1e6c6f set limit table-entries 400000 set optimization normal set limit states 805000 set limit src-nodes 805000 #System aliases loopback = "{ lo0 }" WAN = "{ ix3 }" LAN = "{ igc0 }" WAN2 = "{ ix2 }" WAN3 = "{ ix0 }" WAN4 = "{ ix1 }" LAN2 = "{ igc1 }" LAN3 = "{ igc2 }" LAN4 = "{ igc3 }" WIFI0 = "{ ath0_wlan0 }" #SSH Lockout Table table persist #Snort tables table table table persist file "/etc/bogons" table # User Aliases # Gateways GWWAN_DHCP = " route-to ( ix3 172.21.16.1 ) " GWWAN2_DHCP = " route-to ( ix2 192.168.241.1 ) " GWFailover = " route-to { ( ix3 172.21.16.1 ) } " set loginterface igc0 set skip on pfsync0 set keepcounters scrub on $WAN inet all fragment reassemble scrub on $WAN inet6 all fragment reassemble scrub on $LAN inet all fragment reassemble scrub on $LAN inet6 all fragment reassemble scrub on $WAN2 inet all fragment reassemble scrub on $WAN2 inet6 all fragment reassemble scrub on $WAN3 inet all fragment reassemble scrub on $WAN3 inet6 all fragment reassemble scrub on $WAN4 inet all fragment reassemble scrub on $WAN4 inet6 all fragment reassemble scrub on $LAN2 inet all fragment reassemble scrub on $LAN2 inet6 all fragment reassemble scrub on $LAN3 inet all fragment reassemble scrub on $LAN3 inet6 all fragment reassemble scrub on $LAN4 inet all fragment reassemble scrub on $LAN4 inet6 all fragment reassemble scrub on $WIFI0 inet all fragment reassemble scrub on $WIFI0 inet6 all fragment reassemble no nat proto carp no rdr proto carp binat-anchor "miniupnpd" nat-anchor "miniupnpd" nat-anchor "natearly/*" nat-anchor "natrules/*" # Outbound NAT rules (automatic) # Subnets to NAT tonatsubnets = "{ 127.0.0.0/8 ::1/128 192.168.170.0/24 }" nat on $WAN inet from $tonatsubnets to any port 500 -> 172.21.16.170/32 static-port nat on $WAN inet6 from $tonatsubnets to any port 500 -> (ix3) static-port nat on $WAN inet from $tonatsubnets to any -> 172.21.16.170/32 port 1024:65535 nat on $WAN inet6 from $tonatsubnets to any -> (ix3) port 1024:65535 nat on $WAN2 inet from $tonatsubnets to any port 500 -> 192.168.241.10/32 static-port nat on $WAN2 inet6 from $tonatsubnets to any port 500 -> (ix2) static-port nat on $WAN2 inet from $tonatsubnets to any -> 192.168.241.10/32 port 1024:65535 nat on $WAN2 inet6 from $tonatsubnets to any -> (ix2) port 1024:65535 # TFTP proxy rdr-anchor "tftp-proxy/*" # UPnPd rdr anchor rdr-anchor "miniupnpd" anchor "openvpn/*" anchor "ipsec/*" # block IPv4 link-local. Per RFC 3927, link local "MUST NOT" be forwarded by a routing device, # and clients "MUST NOT" send such packets to a router. FreeBSD won't route 169.254./16, but # route-to can override that, causing problems such as in redmine #2073 block in log quick from 169.254.0.0/16 to any ridentifier 1000000101 label "Block IPv4 link-local" block in log quick from any to 169.254.0.0/16 ridentifier 1000000102 label "Block IPv4 link-local" #--------------------------------------------------------------------------- # default deny rules #--------------------------------------------------------------------------- block in log inet all ridentifier 1000000103 label "Default deny rule IPv4" block out log inet all ridentifier 1000000104 label "Default deny rule IPv4" block in log inet6 all ridentifier 1000000105 label "Default deny rule IPv6" block out log inet6 all ridentifier 1000000106 label "Default deny rule IPv6" # IPv6 ICMP is not auxiliary, it is required for operation # See man icmp6(4) # 1 unreach Destination unreachable # 2 toobig Packet too big # 128 echoreq Echo service request # 129 echorep Echo service reply # 133 routersol Router solicitation # 134 routeradv Router advertisement # 135 neighbrsol Neighbor solicitation # 136 neighbradv Neighbor advertisement pass quick inet6 proto ipv6-icmp from any to any icmp6-type {1,2,135,136} ridentifier 1000000107 keep state # Allow only bare essential icmpv6 packets (NS, NA, and RA, echoreq, echorep) pass out quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {129,133,134,135,136} ridentifier 1000000108 keep state pass out quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {129,133,134,135,136} ridentifier 1000000109 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000110 keep state pass in quick inet6 proto ipv6-icmp from ff02::/16 to fe80::/10 icmp6-type {128,133,134,135,136} ridentifier 1000000111 keep state pass in quick inet6 proto ipv6-icmp from fe80::/10 to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000112 keep state pass in quick inet6 proto ipv6-icmp from :: to ff02::/16 icmp6-type {128,133,134,135,136} ridentifier 1000000113 keep state # We use the mighty pf, we cannot be fooled. block log quick inet proto { tcp, udp } from any port = 0 to any ridentifier 1000000114 label "Block traffic from port 0" block log quick inet proto { tcp, udp } from any to any port = 0 ridentifier 1000000115 label "Block traffic to port 0" block log quick inet6 proto { tcp, udp } from any port = 0 to any ridentifier 1000000116 label "Block traffic from port 0" block log quick inet6 proto { tcp, udp } from any to any port = 0 ridentifier 1000000117 label "Block traffic to port 0" # Snort package block log quick from to any ridentifier 1000000118 label "Block snort2c hosts" block log quick from any to ridentifier 1000000119 label "Block snort2c hosts" # SSH lockout block in log quick proto tcp from to (self) port 22 ridentifier 1000000301 label "sshguard" # webConfigurator lockout block in log quick proto tcp from to (self) port 443 ridentifier 1000000351 label "GUI Lockout" block in log quick from to any ridentifier 1000000400 label "virusprot overload table" # allow our DHCP client out to the WAN pass in quick on $WAN proto udp from any port = 67 to any port = 68 ridentifier 1000000461 label "allow dhcp client out WAN" pass out quick on $WAN proto udp from any port = 68 to any port = 67 ridentifier 1000000462 label "allow dhcp client out WAN" # Not installing DHCP server firewall rules for WAN which is configured for DHCP. # allow our DHCPv6 client out to the WAN pass in quick on $WAN proto udp from fe80::/10 port = 546 to fe80::/10 port = 546 ridentifier 1000000463 label "allow dhcpv6 client in WAN" pass in quick on $WAN proto udp from any port = 547 to any port = 546 ridentifier 1000000464 label "allow dhcpv6 client in WAN" # Add Priority to dhcp6c packets if enabled pass out quick on $WAN proto udp from any port = 546 to any port = 547 ridentifier 1000000465 label "allow dhcpv6 client out WAN" antispoof log for $WAN ridentifier 1000001470 antispoof log for $LAN ridentifier 1000002520 # allow access to DHCP server on LAN pass in quick on $LAN proto udp from any port = 68 to 255.255.255.255 port = 67 ridentifier 1000002541 label "allow access to DHCP server" pass in quick on $LAN proto udp from any port = 68 to 192.168.170.1 port = 67 ridentifier 1000002542 label "allow access to DHCP server" pass out quick on $LAN proto udp from 192.168.170.1 port = 67 to any port = 68 ridentifier 1000002543 label "allow access to DHCP server" # allow access to DHCPv6 server on LAN # We need inet6 icmp for stateless autoconfig and dhcpv6 pass quick on $LAN inet6 proto udp from fe80::/10 to fe80::/10 port = 546 ridentifier 1000002551 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 546 ridentifier 1000002552 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from fe80::/10 to ff02::/16 port = 547 ridentifier 1000002553 label "allow access to DHCPv6 server" pass quick on $LAN inet6 proto udp from ff02::/16 to fe80::/10 port = 547 ridentifier 1000002554 label "allow access to DHCPv6 server" # allow our DHCP client out to the WAN2 pass in quick on $WAN2 proto udp from any port = 67 to any port = 68 ridentifier 1000002561 label "allow dhcp client out WAN2" pass out quick on $WAN2 proto udp from any port = 68 to any port = 67 ridentifier 1000002562 label "allow dhcp client out WAN2" # Not installing DHCP server firewall rules for WAN2 which is configured for DHCP. antispoof log for $WAN2 ridentifier 1000003570 # loopback pass in on $loopback inet all ridentifier 1000009911 label "pass IPv4 loopback" pass out on $loopback inet all ridentifier 1000009912 label "pass IPv4 loopback" pass in on $loopback inet6 all ridentifier 1000009913 label "pass IPv6 loopback" pass out on $loopback inet6 all ridentifier 1000009914 label "pass IPv6 loopback" # let out anything from the firewall host itself and decrypted IPsec traffic pass out inet all keep state allow-opts ridentifier 1000009915 label "let out anything IPv4 from firewall host itself" pass out inet6 all keep state allow-opts ridentifier 1000009916 label "let out anything IPv6 from firewall host itself" pass out route-to ( ix3 172.21.16.1 ) from 172.21.16.170 to !172.21.16.0/24 ridentifier 1000010011 keep state allow-opts label "let out anything from firewall host itself" pass out route-to ( ix2 192.168.241.1 ) from 192.168.241.10 to !192.168.241.0/24 ridentifier 1000010012 keep state allow-opts label "let out anything from firewall host itself" # make sure the user cannot lock himself out of the webConfigurator or SSH pass in quick on igc0 proto tcp from any to (igc0) port { 443 80 22 } ridentifier 10001 keep state label "anti-lockout rule" # User-defined rules follow anchor "userrules/*" pass in quick on $WAN reply-to ( ix3 172.21.16.1 ) inet from any to any ridentifier 1644416432 keep state label "USER_RULE: Allow all ipv4+ipv6 via pfSsh.php" label "id:1644416432" pass in quick on $WAN inet6 from any to any ridentifier 1644416432 keep state label "USER_RULE: Allow all ipv4+ipv6 via pfSsh.php" label "id:1644416432" pass in quick on $LAN $GWWAN2_DHCP inet from 192.168.170.0/24 to any ridentifier 1660690673 keep state label "USER_RULE: Default allow LAN to any via WAN2" label "id:1660690673" label "gw:WAN2_DHCP" pass in quick on $LAN inet from 192.168.170.0/24 to any ridentifier 0100000101 keep state label "USER_RULE: Default allow LAN to any rule" label "id:0100000101" # source address is empty. label "USER_RULE: Default allow LAN IPv6 to any rule" # VPN Rules anchor "tftp-proxy/*"